Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    30/09/2023, 06:54

General

  • Target

    4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe

  • Size

    1.3MB

  • MD5

    851e5c879e22248f985170716734c35f

  • SHA1

    62e337a35f602214df52b0de96a45ce28b636e70

  • SHA256

    4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97

  • SHA512

    ab8b494895d27eb8f12beecbd412fb9653ffcc1b6ef5a35c8eec8c9bbe3355e0e8d6a4cad47ad5a3dc05c42065d208ec91ebdcef50f77809cf6fea6573201070

  • SSDEEP

    24576:TVP4iQzePuruuXj/cjtkugLwnNM9bEjryZFmTcHAdyZbX62z9tywY3+Q:TWBj/cjt1OwNMhS+ZLgdIbX6K9tywq+

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe
    "C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe
      PECMD**pecmd-cmd* PUTF "C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe",,"C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe""#102|SCRIPT"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3060
    • C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2360
      • C:\Windows\svchost.exe
        "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe
          "C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          PID:2144
    • C:\Users\Admin\AppData\Local\Temp\4ca9d6fc21d1f304b88ff024fc8131074a3be1cc0c147b2d1bb4193e364d0b97.exe
      PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~55146968188629411.cmd"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1340
      • C:\Windows\system32\cmd.exe
        cmd /c "C:\Users\Admin\AppData\Local\Temp\~55146968188629411.cmd"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:632
        • C:\Windows\system32\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:1636
        • C:\Windows\system32\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:1520
        • C:\Windows\system32\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:2100
        • C:\Windows\system32\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:2780
  • C:\Windows\svchost.exe
    C:\Windows\svchost.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:1796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~55146968188629411.cmd

    Filesize

    404B

    MD5

    eefd2ab70bd575260278921a63f2d16a

    SHA1

    946e3dcf1473ebbb6353f4e13664631d44bf26d1

    SHA256

    7e03671bf877b42aac92b5523ef8866ae73637cb90794f22ed46ab58f5742030

    SHA512

    6a81b3555d5f23e3799e2515a546aaa072b7a8b031513fa0fc69c2414ef848a510209d3e0f781554d120851598d75690fabf789699e026731732bd0f6ee3b6ea

  • C:\Users\Admin\AppData\Local\Temp\~55146968188629411.cmd

    Filesize

    404B

    MD5

    eefd2ab70bd575260278921a63f2d16a

    SHA1

    946e3dcf1473ebbb6353f4e13664631d44bf26d1

    SHA256

    7e03671bf877b42aac92b5523ef8866ae73637cb90794f22ed46ab58f5742030

    SHA512

    6a81b3555d5f23e3799e2515a546aaa072b7a8b031513fa0fc69c2414ef848a510209d3e0f781554d120851598d75690fabf789699e026731732bd0f6ee3b6ea

  • C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe

    Filesize

    1013KB

    MD5

    a681dcd188b1845fda9f078c1a3b2138

    SHA1

    c8552e6bd406397323490a2b01792f8878588183

    SHA256

    ebacd005c0b543bbf6fa1a8468285258be60c2b201ccf6e7b972f8f4645c4443

    SHA512

    350cc3e979c897af62271d6902b5598d8c5610524f45983913870f2aff62bf2552f552eb8894f74238fdfca565e769a605f48ddf3c8ff97a32f137ab5ea142bf

  • C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe

    Filesize

    1013KB

    MD5

    a681dcd188b1845fda9f078c1a3b2138

    SHA1

    c8552e6bd406397323490a2b01792f8878588183

    SHA256

    ebacd005c0b543bbf6fa1a8468285258be60c2b201ccf6e7b972f8f4645c4443

    SHA512

    350cc3e979c897af62271d6902b5598d8c5610524f45983913870f2aff62bf2552f552eb8894f74238fdfca565e769a605f48ddf3c8ff97a32f137ab5ea142bf

  • C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe

    Filesize

    1.0MB

    MD5

    1d886abc09404b92a7ff409f702ab5e3

    SHA1

    0ce1d79cecd30972f65ba36ba8764a61c59bbfaa

    SHA256

    313000d7b516c9213eea24411c564e65fd717819f678f702efeb8e485b06a66b

    SHA512

    276db90a7ad862afeb37e2a205276979603507f8d4a56b86bb114931db9f65f902e4643220737c8eb86829457273b838f26585da14cb766cfe432d2297975f92

  • C:\Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe

    Filesize

    1.0MB

    MD5

    1d886abc09404b92a7ff409f702ab5e3

    SHA1

    0ce1d79cecd30972f65ba36ba8764a61c59bbfaa

    SHA256

    313000d7b516c9213eea24411c564e65fd717819f678f702efeb8e485b06a66b

    SHA512

    276db90a7ad862afeb37e2a205276979603507f8d4a56b86bb114931db9f65f902e4643220737c8eb86829457273b838f26585da14cb766cfe432d2297975f92

  • C:\Windows\svchost.exe

    Filesize

    35KB

    MD5

    13e083a9d53e948803694a603e69081a

    SHA1

    5f0926b43c970edad8b969cbec9cfebb5ad0a971

    SHA256

    305485ffc5c72617b5b4d6af8a69bc77574c05df4b21829e08bb3a6a2ffd16c5

    SHA512

    a2b4073ba2edafae7f276c2fb1279dd19f2be6dbe67ed1c9f94a082afca70286493b9c33e1fb705d7e1bab3fe66afc84173e9490751611b5c628970892d08814

  • C:\Windows\svchost.exe

    Filesize

    35KB

    MD5

    13e083a9d53e948803694a603e69081a

    SHA1

    5f0926b43c970edad8b969cbec9cfebb5ad0a971

    SHA256

    305485ffc5c72617b5b4d6af8a69bc77574c05df4b21829e08bb3a6a2ffd16c5

    SHA512

    a2b4073ba2edafae7f276c2fb1279dd19f2be6dbe67ed1c9f94a082afca70286493b9c33e1fb705d7e1bab3fe66afc84173e9490751611b5c628970892d08814

  • C:\Windows\svchost.exe

    Filesize

    35KB

    MD5

    13e083a9d53e948803694a603e69081a

    SHA1

    5f0926b43c970edad8b969cbec9cfebb5ad0a971

    SHA256

    305485ffc5c72617b5b4d6af8a69bc77574c05df4b21829e08bb3a6a2ffd16c5

    SHA512

    a2b4073ba2edafae7f276c2fb1279dd19f2be6dbe67ed1c9f94a082afca70286493b9c33e1fb705d7e1bab3fe66afc84173e9490751611b5c628970892d08814

  • C:\Windows\svchost.exe

    Filesize

    35KB

    MD5

    13e083a9d53e948803694a603e69081a

    SHA1

    5f0926b43c970edad8b969cbec9cfebb5ad0a971

    SHA256

    305485ffc5c72617b5b4d6af8a69bc77574c05df4b21829e08bb3a6a2ffd16c5

    SHA512

    a2b4073ba2edafae7f276c2fb1279dd19f2be6dbe67ed1c9f94a082afca70286493b9c33e1fb705d7e1bab3fe66afc84173e9490751611b5c628970892d08814

  • \Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe

    Filesize

    1013KB

    MD5

    a681dcd188b1845fda9f078c1a3b2138

    SHA1

    c8552e6bd406397323490a2b01792f8878588183

    SHA256

    ebacd005c0b543bbf6fa1a8468285258be60c2b201ccf6e7b972f8f4645c4443

    SHA512

    350cc3e979c897af62271d6902b5598d8c5610524f45983913870f2aff62bf2552f552eb8894f74238fdfca565e769a605f48ddf3c8ff97a32f137ab5ea142bf

  • \Users\Admin\AppData\Local\Temp\~~6226934850326949901.tmp.exe

    Filesize

    1.0MB

    MD5

    1d886abc09404b92a7ff409f702ab5e3

    SHA1

    0ce1d79cecd30972f65ba36ba8764a61c59bbfaa

    SHA256

    313000d7b516c9213eea24411c564e65fd717819f678f702efeb8e485b06a66b

    SHA512

    276db90a7ad862afeb37e2a205276979603507f8d4a56b86bb114931db9f65f902e4643220737c8eb86829457273b838f26585da14cb766cfe432d2297975f92

  • memory/1340-47-0x0000000000400000-0x00000000005D8000-memory.dmp

    Filesize

    1.8MB

  • memory/1340-46-0x0000000000400000-0x00000000005D8000-memory.dmp

    Filesize

    1.8MB

  • memory/1796-28-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/1796-64-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/1796-49-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/2196-44-0x0000000002430000-0x0000000002608000-memory.dmp

    Filesize

    1.8MB

  • memory/2196-7-0x00000000003A0000-0x00000000003DF000-memory.dmp

    Filesize

    252KB

  • memory/2196-1-0x0000000002430000-0x0000000002608000-memory.dmp

    Filesize

    1.8MB

  • memory/2196-0-0x0000000000400000-0x00000000005D8000-memory.dmp

    Filesize

    1.8MB

  • memory/2196-45-0x0000000000400000-0x00000000005D8000-memory.dmp

    Filesize

    1.8MB

  • memory/2360-15-0x0000000000020000-0x000000000002D000-memory.dmp

    Filesize

    52KB

  • memory/2360-18-0x0000000000020000-0x000000000002D000-memory.dmp

    Filesize

    52KB

  • memory/2360-60-0x0000000000020000-0x000000000002D000-memory.dmp

    Filesize

    52KB

  • memory/2360-14-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/2740-19-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/2740-29-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/3060-2-0x0000000000400000-0x00000000005D8000-memory.dmp

    Filesize

    1.8MB

  • memory/3060-4-0x0000000000400000-0x00000000005D8000-memory.dmp

    Filesize

    1.8MB